mirror of
https://github.com/Drop-OSS/drop-app.git
synced 2026-07-19 21:43:35 -04:00
[GH-ISSUE #92] [BUG] reqwest doesn't accept OS CAs by default #49
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @quexeky on GitHub (Aug 1, 2025).
Original GitHub issue: https://github.com/Drop-OSS/drop-app/issues/92
Originally assigned to: @quexeky on GitHub.
@DecDuck commented on GitHub (Aug 1, 2025):
We need to use the
native-tlsfeature I think@quexeky commented on GitHub (Aug 1, 2025):
Apparently that's the default
https://docs.rs/reqwest/latest/reqwest/tls/index.html
@DecDuck commented on GitHub (Aug 1, 2025):
Hmmm, I'm apparently mistaken on what that feature does. I don't think there's a way to get reqwest to use system certificates, if it isn't already and we're just idiots. We may need to refactor into a global reqwest Client object and then add certificates & configuration to that.
@quexeky commented on GitHub (Aug 1, 2025):
To be entirely honest, I can't figure out why it's not actually allowing for OS level CAs, yeah. Maybe as a workaround allow uploading CAs?
@DecDuck commented on GitHub (Aug 1, 2025):
I'm thinking we read
$DROP_DATA/cert.crtand add it to the reqwest client. They can contain multiple certificates in a single file, and it's a pretty simple way to implement it.@quexeky commented on GitHub (Aug 1, 2025):
I feel like a directory would be easier, just for the sake of not needing to combine them into one. But yeah I'll get that backend working, gimme like 10 minutes (if that, hopefully lol). Can I get you to test it for me though?
@DecDuck commented on GitHub (Aug 1, 2025):
Oh god. I hope you're putting a single reqwest Client in a LazyLock and not create a function to re-create it every time. We need both async and blocking versions, btw.
Happy to test.
@quexeky commented on GitHub (Aug 1, 2025):
Lmao I was going to make a single function but yeah you're right. I'll still make the function but just call it from the lazylock
You know me too well
@quexeky commented on GitHub (Aug 1, 2025):
Do we want der, pem, or pem bundle?
@DecDuck commented on GitHub (Aug 1, 2025):
PEM bundle
@Beethoven-n commented on GitHub (Aug 1, 2025):
i'm not sure of the difference between pem and pem bundle. would this make any difference to my installation?
@quexeky commented on GitHub (Aug 1, 2025):
It shouldn't. It's just whether you can include multiple certificates in a single certificate file
@quexeky commented on GitHub (Aug 1, 2025):
@DecDuck would you mind testing that? I need to do some stuff atm. Folder should be "certificates" in the drop directory (although I don't think that it'll be created automatically)
@Beethoven-n commented on GitHub (Aug 1, 2025):
can i test? :o
@DecDuck commented on GitHub (Aug 1, 2025):
I was waiting for @quexeky to push it somewhere, I think he forgot to do that.
Edit: found it lol
@quexeky commented on GitHub (Aug 1, 2025):
Any update on this @DecDuck ?
@DecDuck commented on GitHub (Aug 1, 2025):
Nope, I'm sorting out our signing infrastructure.
@tedstriker commented on GitHub (Aug 5, 2025):
Hey guys, in case re-opening this is an option, probably some insights can be shared.
There was a similar issue with another go-based project, that also was
reqwestrelated:https://github.com/moghtech/komodo/issues/130#issuecomment-2588368668
Also it got resolved to the point where OS native certificates have been used instead of directory-based workaround.
Maybe one of you can give it another spin?
@DecDuck commented on GitHub (Aug 5, 2025):
I think we'll support both options. Re-opening.
[BUG] reqwest doesn't accept OS CAs by defaultto [GH-ISSUE #92] [BUG] reqwest doesn't accept OS CAs by default